Snapshot 17362
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Security and Privacy Protecting the data of your organization and its customers is our top priority. Level Access upholds the highest security and privacy standards: We're ISO 27001 certified. The Level Access Platform and UserWay suite have successfully completed SOC 2 Type II audits, as we adhere to maintaining rigorous security, availability, and confidentiality controls. Explore our Trust Center to learn more! infosec@levelaccess.com Privacy PolicyOpens in new tab Filter by Level Access is the category leader in digital accessibility solutions. Our end-to-end approach combines an AI-powered platform with the deepest bench of subject matter expertise, delivering capabilities across the three pillars of successful digital accessibility programs: Audit & Test, Build & Fix, and Governance & Reporting. For more information about the Level Access solution, read the Level Access Platform OverviewOpens in new tab. Compliance SOC 2 ISO 27001:2022 FedRAMP Rev. 5 Resources View all Architecture Diagrams Level Access SOC 2 (2026) High-level Diagram (LAP, Widget Services - UW, Level CI) LAP Architecture Diagram (v1.3) Widget Services Architecture Diagram (2025) Level CI Architecture Diagram (v1.0) Artificial Intelligence (AI) Level Access AI Transparency Statement Business Continuity Level Access Business Continuity Statement Level Access Business Continuity Test Record Level Access Incident Response Plan v4.3 CAIQ CAIQv4.1.0-star_security_questionnaire-generated_at_2026_01_13_LA01_PDF_EDITION FedRAMP FedRAMP AMP Rev. 5 Authorization Opens in new tab HECVAT HECVAT 4.10 (for Trust Center) Insurance Certificate of Insurance ISO Level Access SoA Level Access Information Security Policy Level Access ISO 27001 Certificate Penetration Tests Web Application Penetration Test (Level Access Platform) External Network Penetration Test SOC Level Access - 2026 - SOC 2 Type 2 Report - LAP, Widget, Level CI.pdf UserWay UserWay-Architecture High Level_PDFUA VPAT (ACR) View 2 more Controls View all Governance & Organizational Controls Production inventory maintained Password policy enforced Security policies established and reviewed View 65 more Governance & Organizational Controls controls People & Awareness Controls Employee background checks performed Security awareness training implemented Awareness View 15 more People & Awareness Controls controls Physical & Environmental Security Portable media encrypted Firewall access restricted Network firewalls reviewed View 10 more Physical & Environmental Security controls Technical & Infrastructure Security Unique production database authentication enforced Encryption key access restricted Unique account authentication enforced View 57 more Technical & Infrastructure Security controls Product & Application Security Penetration testing performed Secure development life cycle Application security requirements View 13 more Product & Application Security controls Data Protection and Privacy Data retention procedures established Customer data deleted upon leaving Data classification policy established View 19 more Data Protection and Privacy controls Data collected Accessibility metadata Credit card information Personal health information Website form data Subprocessors View all DataDog, Inc. • SIEM USA Logging and operational monitoring; Security incident and event management Amazon Web Services • Cloud provider USA (Ohio and California) Infrastructure hosting for the software platforms; CDN Microsoft • Cloud provider USA Infrastructure hosting for the software platforms; CDN Amplitude, Inc. • User behavior analytics USA (California) Digital analytics software Updates View all Security Fortinet Credential Exposure (FortiBleed) – No Impact to Level Access Published June 23, 2026 Level Access is aware of recent CISA guidance regarding a global campaign targeting internet‑accessible Fortinet devices using compromised credentials (“FortiBleed”). Level Access does not use Fortinet firewalls or SSL VPN technology in our production environment and is not impacted by this activity. Customer data and Level Access systems, including the Level Access Platform, Level CI, and UserWay Widget, are unaffected. General Level Access Signs CSA AI Trustworthy Pledge Published June 15, 2026 Level Access has signed the Cloud Security Alliance (CSA) AI Trustworthy Pledge, joining organizations committed to advancing responsible and secure AI. The pledge represents a public commitment to developing and deploying AI systems in alignment with key principles, including safety, transparency, ethical accountability, and privacy protection. Level Access is publicly listed among participating organizations: View CSA AI Trustworthy Pledge signatoriesOpens in new tab By participating in this initiative, Level Access reinforces its approach to AI governance—prioritizing secure design, responsible use, and protection of customer data. This milestone supports our broader commitment to transparency and trust as we continue to evolve AI-enabled capabilities across our products and services. Security Datadog / axios npm Supply Chain Incident – No Impact to Level Access Published April 5, 2026 Level Access is not impacted by the recently disclosed npm supply chain incident involving malicious versions of the axios package (versions 1.14.1 and 0.30.4), which Datadog reported may affect certain Datadog open‑source CI/CD and serverless tooling. After internal review, we confirm that Level Access does not use the affected Datadog packages or installation methods associated with this incident. We have additionally scanned our environment and found no instances of the malicious axios versions or related indicators of compromise. Based on our assessment, there is no impact to Level Access systems, products, or customer data. No mitigation actions are required at this time. As part of our ongoing security program, we continue to monitor updates from Datadog and relevant security intelligence sources and will take appropriate action should the situation change. If you have any questions or concerns, please be in touch. Security Cisco Catalyst SD‑WAN Vulnerabilities – No Impact to Level Access Published March 2, 2026 Level Access is not impacted by the recently disclosed vulnerabilities affecting Cisco Catalyst SD‑WAN systems (CVE‑2026‑20127 and CVE‑2022‑20775). After internal review, we confirm that Level Access does not use Cisco Catalyst SD‑WAN or other Cisco SD‑WAN solutions in our environment. Our infrastructure is hosted in Amazon Web Services (AWS) and managed exclusively through AWS‑native services. Level Access does not manage or operate physical network devices or SD‑WAN controllers. As a result, these vulnerabilities are not applicable, and no mitigation actions are required. As part of our ongoing security program, we continue to monitor relevant security advisories and threat intelligence to proactively assess potential risks. If you have any questions or concerns, please be in touch. Media View all Welcome to the Level Access Trust Center! Opens in new tab Take a quick guided tour of our Trust Center and discover the security, privacy, compliance, and governance resources available to customers and prospects. This brief video overview highlights how to access key documentation, review our security program, and find answers to common trust and transparency questions.